In the Linux kernel, the ath6kl driver performs a subtraction of fixed IE offsets from the association request and response lengths, which are unsigned 8‑bit values. Because no lower bound is checked, an underflow can occur, wrapping the value to a large number. The resulting over‑read copies data from adjacent slab memory into a user‑space buffer via nl80211, exposing sensitive information without any privilege escalation.

The vulnerability exists in ath6kl co‑processor driver changes. Any distribution running a kernel with the unpatched ath6kl code is susceptible; no specific kernel versions are listed in the advisory.

The CVSS score of 6.4 indicates a moderate risk profile. The EPSS score of < 1% indicates a very low likelihood of exploitation, and the vulnerability is not included in the CISA KEV catalog. An attacker would need to lure the device to an attacker‑controlled Wi‑Fi access point that sends malformed association frames, a scenario that is feasible over the air. Successful exploitation results in leaking adjacent memory contents to the device user, which could aid further attacks.